security-game/.gitea/workflows/build.yml

name: Full build

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

jobs:
  checks:
    name: Import + headless tests
    runs-on: ubuntu-latest
    env:
      # The container runs as root; silence the recurring engine notice.
      GODOT_SILENCE_ROOT_WARNING: "1"
    steps:
      - uses: actions/checkout@v4

      - name: Install Godot 4.7.2
        run: |
          curl -sL -o /tmp/godot.zip \
            https://github.com/godotengine/godot/releases/download/4.7.2-stable/Godot_v4.7.2-stable_linux.x86_64.zip
          unzip -qo /tmp/godot.zip -d /tmp/godot-bin
          sudo install /tmp/godot-bin/Godot_v4.7.2-stable_linux.x86_64 /usr/local/bin/godot
          godot --version

      - name: Import project (build class cache)
        run: godot --headless --import

      - name: Run headless test suite
        shell: bash
        run: |
          set +e
          output=$(godot --headless --path . --script res://src/test/test_runner.gd 2>&1)
          status=$?
          echo "$output"
          echo "exit=$status"
          if [ "$status" -ne 0 ]; then
            echo "::error::Tests failed"
            exit 1
          fi
          if echo "$output" | grep -q "SCRIPT ERROR"; then
            echo "::error::Script errors detected"
            exit 1
          fi

  build:
    name: Full desktop build + optional release
    # Tags and manual dispatches produce installable binaries. Branch pushes and
    # pull requests only run the cheap checks job (export templates are ~1 GB).
    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    needs: checks
    env:
      GODOT_SILENCE_ROOT_WARNING: "1"
    steps:
      - uses: actions/checkout@v4

      - name: Install Godot 4.7.2 and export templates
        run: |
          curl -sL -o /tmp/godot.zip \
            https://github.com/godotengine/godot/releases/download/4.7.2-stable/Godot_v4.7.2-stable_linux.x86_64.zip
          unzip -qo /tmp/godot.zip -d /tmp/godot-bin
          sudo install /tmp/godot-bin/Godot_v4.7.2-stable_linux.x86_64 /usr/local/bin/godot
          godot --version
          TEMPLATE_DIR="$HOME/.local/share/godot/export_templates/4.7.2.stable"
          NEEDED="version.txt icudt_godot.dat linux_release.x86_64 windows_release_x86_64.exe macos.zip web_nothreads_release.zip web_dlink_nothreads_release.zip"
          curl -sL -o /tmp/templates.tpz \
            https://github.com/godotengine/godot/releases/download/4.7.2-stable/Godot_v4.7.2-stable_export_templates.tpz
          rm -rf /tmp/tpl && mkdir -p /tmp/tpl
          unzip -qo /tmp/templates.tpz -d /tmp/tpl
          mkdir -p "$TEMPLATE_DIR"
          for file in $NEEDED; do
            cp "/tmp/tpl/templates/$file" "$TEMPLATE_DIR/$file"
          done
          ls "$TEMPLATE_DIR" | head -10

      - name: Import project
        run: godot --headless --import

      - name: Export Linux, Windows, macOS
        run: |
          chmod +x tools/*.sh
          ./tools/build_releases.sh

      - name: Package Windows installer (NSIS)
        run: |
          sudo apt-get update && sudo apt-get install -y nsis p7zip-full
          VERSION="$(sed -n 's/.*config\/version="\([^"]*\)".*/\1/p' project.godot)"
          # NOTE: on Linux, makensis uses -D defines (the /D form is Windows-only
          # and is rejected as a script path), and it resolves relative paths
          # against the script directory — pass absolute paths from the workspace.
          cp assets/textures/icon.ico packaging/windows/gig-line.ico
          makensis \
            -DVERSION="$VERSION" \
            -DARTIFACT="$PWD/build/gig-line-windows-$VERSION.exe" \
            -DICON="$PWD/packaging/windows/gig-line.ico" \
            -DOUT="$PWD/build/gig-line-setup-$VERSION.exe" \
            packaging/windows/gig-line.nsi

      - name: Verify Windows installer contents
        run: |
          VERSION="$(sed -n 's/.*config\/version="\([^"]*\)".*/\1/p' project.godot)"
          ls -la build/gig-line-setup-$VERSION.exe
          7z l build/gig-line-setup-$VERSION.exe | grep -E "gig-line.exe|uninstall.exe"

      - name: Package Linux AppImage
        run: |
          bash packaging/linux/build_appimage.sh

      - name: Upload installers (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: gig-line-build
          path: build/*
          if-no-files-found: error

      - name: Publish Gitea release (tags only)
        if: startsWith(github.ref, 'refs/tags/')
        env:
          # An explicit repo secret wins. Without one, publish_release.sh reuses
          # the local git extraheader that actions/checkout configures on the job
          # (the runner's own credentials), so tag builds still publish.
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          VERSION: ${{ github.ref_name }}
        run: |
          chmod +x tools/publish_release.sh
          ./tools/publish_release.sh "${VERSION#v}"